Return
-
Title
Active directory users unable to logon to Redhat server and secure log shows "auth could not identify password" error message. -
Description
An Active Directory user is shown as allowed by running the 'vastool user checkaccess <username>' command.However when the user tries to logon on they get an 'Access Denied' message.
Local users can log on fine.
The /var/log/secure log file shows an entry similar to the following:
Dec 18 12:57:53 Redhat01 sshd[6170]: pam_unix(sshd:auth): auth could not identify password for [user1] -
Cause
Possible PAM configuration issue.If the user is logging on using SSH then check the following PAM configuration file:/etc/pam.d/sshdNote that this file may include reference to either password-auth or system-auth.If so, then also check these files.
Look for the following pam_localuser.so entry in the auth section:
-----------------------------------------------------------------------------------------
auth [default=1 ignore=ignore success=ok] pam_localuser.so
-----------------------------------------------------------------------------------------
This entry will check /etc/passwd to determine if it is a local user and prevent any Active Directory users from logging in. -
Resolution
Remove the following entry from any PAM configuration files within the /etc/pam.d directory to allow Active Directory users to authenticate:
-----------------------------------------------------------------------------------------
auth [default=1 ignore=ignore success=ok] pam_localuser.so
----------------------------------------------------------------------------------------- -
Additional Information
On Authentication services version 4.7 and above you will see this message in the 'vastool status' output if pam_localuser entry exists: INFO: 629 pam_localuser found in pam configuration, this might prevent QAS users from logging in